The Crypto vulnerability dubbed DUHK1 min read

Cryptography researchers from the University of Pennsylvania and John Hopkins University have found a vulnerability in an encryption algorithm that until recently was commonly used to generate cryptographic keys that secure VPN connections and web browsing sessions. Although now a legacy algorithm it is still used in at least 23000 devices which were found via their publicly visible IPv4 address.

The DUHK vulnerability allows attackers to decrypt secure communications they intercept over a secure VPN or secure web sessions. This means that information like Login credentials, banking details and other sensitive information could be decrypted. The attack itself is also passive so there is no way to detect that your details are being intercepted and decrypted.

Security researchers often find major vulnerabilities but in a lot of cases the actual attack is time consuming and not practical. This vulnerability is technical however, if the attacker knows what they are doing it can be exploited on a modern computer in around 4 minutes.

For an end user the advice is, as with many other discovered vulnerabilities is to keep your software up to date, in this case specifically any VPN applications and web browsers.

Author: Michael Collins, CyNation